Allocating memory access control policies

Patent metadata

Field	Value
Publication number	US-9342704-B2
Application number	US-201113993421-A
Country	US
Kind code	B2
Filing date	Dec 28, 2011
Priority date	Dec 28, 2011
Publication date	May 17, 2016
Grant date	May 17, 2016

Abstract

Enabling access control caches for co-processors to be charged using a VMX-nonroot instruction. As a result a transition to VMX-root is not needed, saving the cycles involved in such a transition.

First claim

What is claimed is:

1. A method comprising:
enabling access control context to be changed, by a hardware computer processor, using an instruction in virtualization mode that is not fully privileged and without transitioning to a fully privileged mode only accessible by a virtual machine monitor, by changing a memory map for a device while limiting access to other portions of the memory.

2. The method of claim 1 including setting up access tables with a unique root pointer for a set of permissions.

3. The method of claim 2 including assigning the set of permissions to a context.

4. The method of claim 3 including switching root pointers.

5. The method of claim 3 including flushing permission caches.

6. The method of claim 1 including offloading kernel scheduling to a graphics processor.

7. The method of claim 6 including enabling the graphics processor to switch root pointers.

8. The method of claim 1 including setting up a context for a co-processor in the mode that is not fully privileged.

9. The method of claim 8 including sending the context to the fully privileged mode.

10. The method of claim 9 including extracting access control information for the context in the fully privileged mode.

11. A non-transitory computer readable medium storing instructions to enable a hardware computer processor to perform:
enabling access control context to be changed using an instruction in virtualization mode that is not fully privileged and without transitioning to a fully privileged mode only accessible by a virtual machine monitor, by changing a memory map for a device while limiting access to other portions of the memory.

12. The medium of claim 11 further storing instructions to perform a method including setting up access tables with a unique root pointer for a set of permissions.

13. The medium of claim 12 further storing instructions to perform a method including assigning the set of permissions to a context.

14. The medium of claim 13 further storing instructions to perform a method including switching root pointers.

15. The medium of claim 13 further storing instructions to perform a method including flushing permission caches.

16. The medium of claim 11 further storing instructions to perform a method including offloading kernel scheduling to a graphics processor.

17. The medium of claim 16 further storing instructions to perform a method including enabling the graphics processor to switch root pointers.

18. The medium of claim 11 further storing instructions to perform a method including setting up a context for a co-processor in the mode that is not fully privileged.

19. The medium of claim 18 further storing instructions to perform a method including sending the context to the mode that is fully privileged.

20. The medium of claim 19 further storing instructions to perform a method including extracting access control information for the context in the mode that is fully privileged.

21. An apparatus comprising:
a hardware computer processor to enable access control context to be changed using an instruction in virtualization mode that is not fully privileged and without transitioning to a fully privileged mode only accessible by a virtual machine monitor, by changing a memory map for a device while limiting access to other portions of memory; and
a hardware computer co-processor coupled to said processor.

22. The apparatus of claim 21 said processor to set up access tables with a unique root pointer for a set of permissions.

23. The apparatus of claim 22 said processor to assign the set of permissions to a context.

24. The apparatus of claim 23 said processor to switch root pointers.

25. The apparatus of claim 23 said processor to flush permission caches.

26. The apparatus of claim 21 said processor to offload kernel scheduling to the co-processor that is a graphics processor.

27. The apparatus of claim 26 said processor to enable the co-processor to switch root pointers.

28. The apparatus of claim 21 said processor to set up a context for the co-processor in the mode that is not fully privileged.

29. The apparatus of claim 28 said processor to send the context to the fully privileged mode.

30. The apparatus of claim 29 said processor to extract access control information for the context in the fully privileged mode.

Assignees

• Dewan Prashant
• Martin Jason
• Savagaonkar Uday R
• Rozas Carlos V
• Intel Corp

Inventors

• Dewan Prashant
• Martin Jason
• Savagaonkar Uday R
• Rozas Carlos V

Classifications

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/62 Primary

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title